Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5824). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
It was discovered that the VersionHelper12 class did not properly honor whether or not modifyThreadGroup is restricted. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Oracle Java SE Update 45 fixes an unspecified vulnerability in the 2D component (CVE-2013-5843). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5789). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5787). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
It was discovered that ObjectInputStream and ObjectOutputStream serialization handling did not properly perform certain checks. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the checkPackageAccess function of the class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the virtual machine.
It was discovered that the awtgetPixelByte, awtgetPixelShort, awtsetPixelByte, and awtsetPixelShort functions did not properly verify certain raster attributes. A remote attacker could use this flaw to trigger a Java Virtual Machine memory corruption and, possibly, execute arbitrary code with the privileges of the user running the virtual machine.
It was discovered that the CORBA component did not properly check the permissions of RMIConnection stubs built as part of the JDK. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the Java2d Disposer did not properly dispose of resources if an exception occured during the process. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the JPEGImageReader and JPEGImageWriter classes did not properly verify the band size. An untrusted Java application or applet could possibly use this flaw to trigger a Java Virtual Machine memory corruption.
Unspecified vulnerability in the 2D component in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-1493.
Unspecified vulnerability in Oracle Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5832). Upstream has CVSSv2 scored this issue as: 9.3/AV:N/AC:M/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
It was discovered that various security and access checks are not properly performed for certain CORBA classes. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, and JavaFX 2.2.40 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX.
Unspecified vulnerability in Oracle Java SE 7u25 and earlier, and Java SE Embedded 7u25 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
Unspecified vulnerability in Oracle Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX.
Unspecified vulnerability in Oracle Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing, a different vulnerability than CVE-2013-5805.
Unspecified vulnerability in the Java SE and JavaFX components in Oracle Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2013-5775.
Unspecified vulnerability in Oracle Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Unspecified vulnerability in Oracle Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing, a different vulnerability than CVE-2013-5806.
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5852). Upstream has CVSSv2 scored this issue as: 7.6/AV:N/AC:H/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
It was discovered that XMLConstants.FEATURESECUREPROCESSING setting was not properly honored by javax.xml.transform.TransformerFactory transformers. A remote attacker could use this flaw to supply crafted XML that would be processed without the intended security restrictions.
Unspecified vulnerability in the Java SE and JavaFX components in Oracle Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2013-5777.
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5812). Upstream has CVSSv2 scored this issue as: 6.4/AV:N/AC:L/Au:N/C:P/I:N/A:P
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
It was discovered that java.util.TimeZone does not properly restrict changing the time zone to the default time zone. An untrusted Java application or applet could exploit this to change the default time zone of their application contexts.
It was discovered that AWT JTable did not properly perform certain access checks. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It has been identified that it is possible to inject malicious unsigned bytecode into a signed JAR without failing jarsigner verification. This flaw could be exploited in environments where contents of a verified JAR is considered trusted and unpacked for use.
Note that if the signed JAR is used at runtime, with signature intact, a fatal runtime exception is thrown.
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5831). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html